Bug can cause deadly failures when anesthesia device is connected to cell phones

No, it's not clear why anyone would ever connect a phone to a medical device.

Federal safety officials have issued an urgent warning about software defects in an anesthesia delivery system that can cause life-threatening failures at unexpected times, including when a cellphone or other device is plugged into one of its USB ports.

The ARKON anesthesia delivery system is used in hospitals to deliver oxygen, anesthetic vapor, and nitrous oxide to patients during surgical procedures. It is manufactured by UK-based Spacelabs Healthcare Ltd., which issued a recall in March. A bug in Version 2.0 of the software running on the device is so serious that it could cause severe injury or death, the US Food and Drug Administration warned last week in what's known as a Class I recall. In part, the FDA advisory read:

Reason for Recall: Spacelabs Healthcare is recalling the ARKON Anesthesia System with Version 2.0 Software due to a software defect. This software issue may cause the System to stop working and require manual ventilation of patients. In addition, if a cell phone or other USB device is plugged into one of the four USB ports for charging, this may also cause the System to stop working.

This defect may cause serious adverse health consequences, including hypoxemia and death. Spacelabs Healthcare received one report related to the software defect. There has been no injuries or deaths associated with this malfunction.

At least 16 vulnerable units were in place at hospitals in North Carolina and South Carolina, according to the Class I advisory, the most serious type of recall notice issued by the FDA.

ARKON anesthesia delivery and ventilation.

It remains unclear why such a sensitive medical device has USB ports or why there would ever be a medical necessity for plugging a cell phone into one of them. Assuming there are reasons for including the ports in the first place, it's hard to understand how a bug in the way they handle connected devices wasn't caught during quality assurance testing. It's the second recall of a Spacelabs-made anesthesia device in the past year. In October, the manufacturer recalled its BleaseSirius and BleaseFocus anesthesia workstations because of loose fastening hardware in an absorber. The FDA issued a Class I advisory in response to that flaw as well.

Promoted Comments

First rule of fight club: DO NOT PLUG THINGS INTO, NOR FUTZ WITH AN OPERATING, LIFE SUSTAINING MEDICAL DEVICESecond rule of fight club: ASSUME ALL USERS ARE IDIOTS, AND DESIGN ACCORDINGLYThird rule of fight club: THE FIRST RULE WILL INEVITABLY BE BROKEN

Clinicians that have been on the job for 40hrs straight, aren't exactly thinking straight. Or the clinician may be visiting (substitute) nurse may not be familiar with the particular device.

It's entirely legitimate for these machines to have USB ports exposed- we use them frequently to extract monitoring data, and information about drug dosages, ventilation etc following a case for the patient record, for personal audit, and for research purposes. They aren't (just) for charging devices!

That said, they should be protected so the device you plug in can only extract data, it should never be able to influence the function of the machine. The therapeutic end of the software really shouldn't be directly available to the monitoring software anyway, that's how our machines are designed.

Although, after watching the promotional video, it looks like part of their goal with the system was to make it more compact and to allow additional work surfaces, so that explains the USB and Ethernet ports on the device.

Isn't it obvious? Someone in the OR wants to charge their phone, sees an open USB port, plugs it in. Of course, that sounds criminal, but maybe it doesn't even require it being in use, that is, maybe a janitor uses it to charge their phone overnight and then the bug crops up the next day when the device goes into use.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

I am betting that the developers assumed that the ports would be used for connecting a storage device to download reports from the device and never imagined that someone would connect a device just for charging. So the drivers probably bonk when a storage device is not found.

People are always looking for places to charge their phones. I'll bet anything that the way they discovered this was that someone tried to charge their phone when visiting someone in the hospital. It's kind of a stupid thing to do, but the device maker should be anticipating stupid people existing in hospitals. If you've ever been a patient or worked in one, you'll understand what I mean.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Most likely you can plug in a USB stick to update the system or export gathered data. If you download the data to a smartphone this could happen.

For all the money that goes into these things the unit number is so small that there can not be a huge software development team. I am even laughing at good testing. 5 devs+testers would cost you a cool million in 18 months ( including admin costs etc. ) Let's suppose software is 10% of development cost. And development is 20% of all costs then we are talking of 50 million to get something like that to the market. Not surprised AT ALL that the quality of the software sucks.

Pulled off their website."Using innovative concepts in industrial design, ARKON offers a variety of features that help to manage overall workflow in the operating room, including:Natural storage areas for equipment and paperworkAn expandable work surfaceA system status computer that communicates, the state of the battery back up, inlet gas pressure, gas scavenging and machine check outSeven electrical outlets distributed where they are neededBuilt-in USB and Ethernet portsAlternate height work surfacesA convenient drop down shelfA pull out keyboard trayBuilt-in lighting where you want it"

I can't find anything else on the machine but it sounds like those are meant to be accessible by anyone.Especially since there are 4 ports.

The devices have USB ports and/or LAN connections because the data collected by them are considered to be part of the patient record, and must be downloaded from the device and attached to the electronic patient record at the time the record is finalized and submitted to the system.

The FDA's regulation makes connection between these devices a PITA for both the manufacturers and the medical personnel that use them: Every change to the device, even a driver update or software fix, is required to go through FDA approval again. Companies spend months or years working on their interfaces to these devices before they are able to get approval.

Real world example: There is an electronic patient care record vendor that I know of who could not include an update in their ePCR system to automatically download records from another vendor's EKG device because the FDA requirements made time to market impractical for the healthcare organizations that needed the functionality. The solution provided by both vendors was a dedicated USB key to take the EKG information off of the device and upload it to the patient record.

We in healthcare IT deal with this sort of nonsense all the time; I'd estimate that interoperability issues for our healthcare environment consume about 40% of my at-work time.

People are always looking for places to charge their phones. I'll bet anything that the way they discovered this was that someone tried to charge their phone when visiting someone in the hospital. It's kind of a stupid thing to do, but the device maker should be anticipating stupid people existing in hospitals. If you've ever been a patient or worked in one, you'll understand what I mean.

Though this machine isn't going to be where visitors can reach it. What's even better/worse is that this is probably some professional in the OR waiting on a page with a dying a phone and suddenly sees the USB port.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

This doesn't seem like that dumb of a thing. I've read this article, and if I ever found myself confined to a hospital bed with a low battery cellphone and that port was more convenient than a wall outlet, I'd STILL probably try charging my phone there.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

This doesn't seem like that dumb of a thing. I've read this article, and if I ever found myself confined to a hospital bed with a low battery cellphone and that port was more convenient than a wall outlet, I'd STILL probably try charging my phone there.

"Potentially sensitive medical equipment? Yeah, that sounds like somewhere I should plug in my phone." If you're confined to your bed, I'm sure there's a nurse or someone around you could ask to plug the phone in for you instead of using the machine that's helping to maintain your health.

Since they say "In addition, if a cell phone or other USB device is plugged into one of the four USB ports for charging" I wouldn't be surprised if there was an issue where it tried to draw too much current, causing a voltage drop or overheating of some power component that caused a bug. Certainly would be interested in details of the exact problem.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

This doesn't seem like that dumb of a thing. I've read this article, and if I ever found myself confined to a hospital bed with a low battery cellphone and that port was more convenient than a wall outlet, I'd STILL probably try charging my phone there.

I don't think I could fault a health care professional for plugging his/her phone in either. "Not putting a patient at risk/killing them when someone plugs anything into an exposed* USB port" is not an unreasonable assumption on the part of a doctor/nurse/etc.

* Exposed is an understatement - looking at a picture of the machine it looks like the USB ports were put there specifically so someone could charge their device.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Regarding this particular medical device I'm also in the dark regarding why someone (medical personnel) would connect an cellphone to it. But there are several other instances where it is useful.For instance in ambulances (guess mostly that operate in rural areas) you have defibrillators that sends heart monitoring data to the hospital while on route so the doctors/surgeons have a clearer picture of the severity before the patient arrives.Note: I'm not medically trained so I apologize if I got some nuances of the actual way the data is collected and used wrong.

I could see a single port on a custom device for firmware updates/etc; 4 USB ports sounds like they built the system around an off the shelf PC motherboard. (Although in that case I'm mildly surprised it only had 4 ports not 8 or 10.)

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

This doesn't seem like that dumb of a thing. I've read this article, and if I ever found myself confined to a hospital bed with a low battery cellphone and that port was more convenient than a wall outlet, I'd STILL probably try charging my phone there.

"Potentially sensitive medical equipment? Yeah, that sounds like somewhere I should plug in my phone." If you're confined to your bed, I'm sure there's a nurse or someone around you could ask to plug the phone in for you instead of using the machine that's helping to maintain your health.

Coming from a lifetime of experience saying that the worst case scenario of plugging my phone into device USB ports is that it doesn't actually charge the phone, but is otherwise harmless, it's not an unreasonable expectation. I know there have been honeypot USB "charging stations" that plant viruses or skim data from the phone, but I've never seen a device with a USB port actually fail because I plugged my phone in.

Someone less tech savvy than the average Ars reader would make the assumption that it's safe nearly 100% of the time.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

This doesn't seem like that dumb of a thing. I've read this article, and if I ever found myself confined to a hospital bed with a low battery cellphone and that port was more convenient than a wall outlet, I'd STILL probably try charging my phone there.

Agreed. Even if I had second thoughts it would be because of concerns about what the device might do to my phone. It's a fact that the USB connector has become the defacto low-voltage power outlet. Every product designer, whether it's a computer or a car or a medical device or anything at all with a USB port, should be expecting random crap to get plugged into it.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Except if close to a bed and/or where the port(s) is/are visible, I could totally see a patient or visitor thinking "hmmm, my cell phone could use a quick charge. I wonder if I could charge it off that port?"

People do dumb things. There are also many dumb people. Dumb people + doing dumb things = spectacularly bad results.

So the fact the flaw exists is a serious problem, even if it is only that 1 in 10 million patients/vistors who does something stupid.

This doesn't seem like that dumb of a thing. I've read this article, and if I ever found myself confined to a hospital bed with a low battery cellphone and that port was more convenient than a wall outlet, I'd STILL probably try charging my phone there.

I don't think I could fault a health care professional for plugging his/her phone in either. "Not putting a patient at risk/killing them when someone plugs anything into an exposed* USB port" is not an unreasonable assumption on the part of a doctor/nurse/etc.

* Exposed is an understatement - looking at a picture of the machine it looks like the USB ports were put there specifically so someone could charge their device.

I agree this isn't at all unreasonable for an anesthetist to do. Anesthesia workstations are increasingly filled with technology for patient care and documentation and cell phones are an increasingly important part of a doctor's available tools (primarily communication obviously but lots of information is available also). I've worked as an engineer for a medical school anesthesia department for a few years and if the new anesthesia workstation had a prominent USB port the doctor would think "Wow, great idea. They put a port for me to keep my phone charged while I'm stationary in the OR so that it's charged when I'm on the move."

EDIT: Also this equipment has NOTHING to do with hospital beds or patients interacting with them at all. These things are used in operating rooms by licensed anesthetists (MDs or specially licensed nurses). These devices are not ever left alone while in use or left with a patient in a bed.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Regarding this particular medical device I'm also in the dark regarding why someone (medical personnel) would connect an cellphone to it. But there are several other instances where it is useful.For instance in ambulances (guess mostly that operate in rural areas) you have defibrillators that sends heart monitoring data to the hospital while on route so the doctors/surgeons have a clearer picture of the severity before the patient arrives.Note: I'm not medically trained so I apologize if I got some nuances of the actual way the data is collected and used wrong.

Since every piece of medical equipment seems to use the same beep as an alarm tone, connectivity to a monitoring station is important. Apparently a lot of these systems use wireless to communicate, since I recall seeing Ethernet cords coiled up behind ICU equipment and those were never plugged into the wall.

If the staff is stupid enough to bring a cell phone into the OR, it is time to find another hospital.

Edited to say, this is not going into a patient room, it is going into the OR!

I can see you've never worked in any OR anywhere. You don't have any idea how these things are used, by who, and what they are doing while they are being used.

EDIT: I can see I'm being downvoted for being dickish, but seriously, your comment is akin to huffing that your auto mechanic has grease on his hands so you should find another auto shop. It is completely ridiculous to anybody who has any idea how operating rooms function, particularly from the anesthesia (non sterile) side.

"No, it's not clear why anyone would ever connect a phone to a medical device."

My thoughts exactly after reading the title.

Most of you probably haven't worked in a hospital to realize how important it is to be always connected to the online medical books and to be able to look up patients data on your phone as well.So yeah. It's important to have your phone always charged.

Routine surgical cases are seldom challenging for anesthesia providers. So while the case is underway, many spend most of their time on a laptop, tablet, or phone. So much time, they need to keep it powered up. So that handy USB port! Not surprising in the slightest for anyone in the OR, nor would it be surprising to the manufacturer.